You can limit the data you see based on criteria you specify. For example, you might want to filter the results to the last three months, or for a certain user. You can also limit the number of rows displayed, or the number of pivot columns displayed. This page introduces you to filtering and limiting data.
Filtering Data Overview
You can restrict the data you’re viewing to items of interest by adding filters. For example, you might limit the results to certain dates, users, locations, or anything else that is part of your data. Any field in your data can become a filter.
You don’t necessarily need to add a dimension or measure to your results in order to filter on it. For example, you can create a report that filters the event date to just the last 90 days, even though your report only shows Application and Number of Events.
There are several different types of filters:
Basic Filters — Most of the time you’ll use this type of filter. In these cases the system provides appropriate drop-down lists, calendar widgets, and text fields you can use to put in your restriction.
Custom Filters — When you need to specify more detailed business logic (especially when you need to combine AND and OR logic together, or want to use functions), you can use custom filters.
You can use any combination of these filter types in your report.
Basic Filters
There are several different ways to add a basic filter:
You’ll see that a filter appears in the Filters section above your results. To remove a filter, click the X to its right.
Standard Types of Filter Options
The available options for the filter depend on its type.
For example, a time dimension will have options to select a time range, while a numeric dimension will have options like equal to or greater than.
For text dimensions, the system helps you choose filter values by displaying a list of existing data values for that field. As you type, the system narrows the list to just those values that include that text.
If you need to enter a special character in your filter, such as , or “, you can do so by adding a leading backslash (). For example, to filter on Santa Cruz, CA, you would enter Santa Cruz , CA.
Entering multiple values into a filter, where appropriate, creates an OR condition, meaning all of the values are applied to the filter.
If you would like to filter on a large set of values, you can paste a long list of values into the filter field. However, the maximum number of values you can paste may be limited by your browser or other elements along your network.
Click the + to the right of a filter to add another option to the filter. The new option will appear as either an OR condition or an AND condition, depending on the type of filter option.
If you need a more complex filter or set of filters, you can create a custom filter.
Tip
To see specific events based on timestamp, apply a match (exact) filter at the dashboard level with format “YYYY/MM/DD hh.ss”.
For example, open any dashboard in edit mode and in the Field Picker, select the Filter by field button to the right of the field name and select the ‘Event Date‘ field.
In the Results tab of the Data panel, select the gear menu button to the right of the field, and select Filter on > Advanced > matches (advanced).
In the text field, enter your filter expression (2022/10/01 00:00:01 to 2022/01/01 18:29:01) and click Update.
Custom Filters
Custom filters let you create filters with custom conditions that might not be available with the other, simpler filter types. These conditions can be simple or complex. You write the fields, constants, functions, and operators that express the filtering that you want.
When you add a custom filter, the system displays an editor for you to build an expression that evaluates as true or false. When you run the report, the system will only return rows for which that condition is true.
Adding a Custom Filter
To add a custom filter, expand the Filters section and click the Custom Filter checkbox in the upper right:
To create an expression for your custom filter, start typing a dimension or function. The system will display a list of functions, operators, and field names that you might want to use in your expression. Click on a term in the drop-down to add it to your expression. When finished, your expression must evaluate to true or false.
Click Run (or use the keyboard shortcut Command-Enter for Mac or Ctrl+Enter for Windows) to run your report with your custom filter applied.
The Creating Expressions page explains how to create expressions and how the editor helps you.
Expressions can use as many fields, functions, and operators as your business logic requires. Just keep in mind that the more complex your condition, the more work the database must do to evaluate it, which may lengthen report times.
warning Because custom filters are used to create a database report, you cannot refer to measures in a custom filter, or use any functions that rely on report results. The Creating Expressions page explains how to use expressions in custom fields in more detail. The Functions and Operators page shows you the available functions and identifies which can be used in a custom filter.
Removing a Custom Filter
To remove a custom filter, you can:
Click the X to the right of the expression to completely delete it.
Deselect the Custom Filter checkbox to stop using the expression. As long as you do not close the page, the system will remember what you have typed, and your expression will reappear if you click Custom Filter again.
The Difference Between Filtering Dimensions and Filtering Measures
Filters are applied differently to dimensions and measures.
Filtering Dimensions: Restricts Raw Data Before Calculations
When you filter on a dimension, you are restricting the raw data before any calculations are made.
Filtering Measures: Calculates First, Then Restricts the Results
When you filter on a measure, however, you are restricting the results after the measure has been calculated.
Limiting Data
Sometimes you want to see only a subset of the complete results from your report. You can do this by setting a row limit, a column limit, or both.
Without a set row limit, the system supports up to 5,000 rows. The system supports an unlimited number of columns for unpivoted reports, although we recommend that you have 50 or fewer columns for browser performance. The system supports up to 200 columns for pivot reports but sets a default column limit of 50 columns.
Row Limits
When you set a row limit, the system will only display up to the number of rows you have set. You are warned if you might be hiding data by setting a row limit that is too low. Your sort order is important in these situations; the system first applies the sort, and then applies the limit.
If you reach a row limit, you will not be able to sort row totals or table calculations. Best practice, use dashboard and widget level filters to limit results for large file sets.
Optionally, you can also selectively download results by setting ‘Custom’ and defining a limit between 1 – 10,000.
The Netskope UI displays up to 5000 rows of data as a visualization.
Column Limits
If you’ve added a pivot to your report, you can also apply a column limit of up to 200. The system will warn you if you might be hiding data by setting a column limit that is too low. Again, the sort order of your pivot is important, because the system first applies the sort, and then applies the limit. For example, if you want to see the five most recent months when events were created, make sure you’re sorting by the event created month.
Dimensions, dimension table calculations, row total columns, and measure table calculations outside of pivots are not counted toward the column limit. Pivoted groups each count as one column toward the column limit.